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Abstract 

We study the control complexity of fallback voting. Like manipulation and bribery, electoral 
control describes ways of changing the outcome of an election; unlike manipulation or bribery 
attempts, control actions — such as adding/deleting/partitioning either candidates or voters — 
modify the participative structure of an election. Via such actions one can try to either make 
a favorite candidate win ("constructive control") or prevent a despised candidate from winning 
("destructive control"). Computational complexity can be used to protect elections from control 
attempts, i.e., proving an election system resistant to some type of control shows that the success 
of the corresponding control action, though not impossible, is computationally prohibitive. 

We show that fallback voting, an election system combining approval with majority voting 
[ BS09 1, is resistant to each of the common types of candidate control and to each common 
type of constructive control. Among natural election systems with a polynomial-time winner 
problem, only plurality and sincere-strategy preference-based approval voting (SP-AV) were 
previously known to be fully resistant to candidate control [BTT92 HHR07 , ENR09 1, and only 
Copeland voting and SP-AV were previously known to be fully resistant to constructive control 
[ FHHR09a ENR09 1 . However, plurality has fewer resistances to voter control, Copeland voting 
has fewer resistances to destructive control, and SP-AV (which like fallback voting has 19 out 
of 22 proven control resistances) is arguably less natural a system than fallback voting. 



1 Introduction 



Voting is a way of aggregating individual preferences (or votes) to achieve a societal consensus on 
which among several alternatives (or candidates) to choose. This is a central method of decision- 
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Work done in part while the first author was visiting Universitat Trier, while the third author was visiting the University 
of Rochester, and while the first and third author were visiting NICTA, Sydney, and the University of Newcastle. 
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making not only in human societies but also in, e.g., multiagent systems where autonomous software 
agents may have differing individual preferences on a given number of alternatives. Voting has 
been studied intensely in areas as diverse as social choice theory and political science, economics, 
operations research, artificial intelligence, and other fields of computer science. Voting applications 
in computer science include the web-page ranking problem [DKNS01], similarity search [F KS03L 
planning [ER93], and recommender systems [GMHS99]. For such applications, it is important to 
understand the computational properties of election systems. 

Various ways of tampering with the outcome of elections have been studied from a complexity- 
theoretic perspective, in particular the complexity of changing an election's outcome by manipu- 
lation HBTT89I IBQ9T1 ICSL07I IHH07I IFHHR09ci control HBTT921 IHHR07I IFHHR09al IHHR09I 
IENR09I IFHHR09cL and bribery HFHH09I lFHHR09aL see also the surveys by Faliszewski et 
al. HFHHR09M and Baumeister et al. llBEH+091 . 

In control scenarios, an external actor — commonly referred to as the "chair" — seeks to either 
make a favorite candidate win (constructive control) or block a despised candidate's victory (de- 
structive control) via actions that change the participative structure of the election. Such actions 
include adding, deleting, and partitioning either candidates or voters; the 22 commonly studied 
control actions, and their corresponding control problems, are described formally in Section[2] 

We study the control complexity of fallback voting, an election system introduced by Brams 
and Sanver [BS09] as a way of combining approval and preference-based voting. We prove that 
fallback voting is resistant (i.e., the corresponding control problem is NP-hard) to each of the 14 
common types of candidate control. In addition, we show that fallback voting is resistant to five 
types of voter control. In particular, fallback voting is resistant to each of the 1 1 common types of 
constructive control. Among natural election systems with a polynomial-time winner determina- 
tion procedure, only plurality and sincere-strategy preference-based approval voting (SP-AV) were 
previously known to be fully resistant to candidate control MBTT921 IHHR07 , ENR09], and only 
Copeland voting and SP-AV were previously known to be fully resistant to constructive control 
MFHHR09a[ [ENR09I. However. SP-AV (as modified by IENR09I ) is arguably less natural a system 
than fallback votinglJ and plurality has fewer resistances to voter control and Copeland voting has 
fewer resistances to destructive control than fallback voting. 

This paper is organized as follows. In Section |2j we recall some notions from voting theory, 
define the commonly studied types of control, and explain Brams and Sanver's fallback voting 
procedure [BS06] in detail. Our results on the control complexity of fallback voting are presented 
in Section [3] Finally, Section [Uprovides some conclusions and open questions. 

1 SP-AV is (a variant of) another hybrid system combining approval and preference-based voting that was also pro- 
posed by Brams and Sanver (see |BS06|). The reason we said SP-AV is less natural than fallback voting is that, in order to 
preserve "admissibility" of votes (as required by Brams and Sanver | BS06 1 to preclude trivial approval strategies), SP-AV 
(as modified by Erdelyi et al. |ENR09 |) employs an additional rule to (re-)coerce admissibility (in particular, if in the 
course of a control action an originally admissible vote becomes inadmissible). This point has been discussed in detail by 
Baumeister et al. |BEH + 09|. In a nutshell, this rule, if applied, changes the approval strategies of the votes originally cast 
by the voters. The effect of this rule is that SP-AV can be seen as a hybrid between approval and plurality voting, and it 
indeed possesses each resistance either of these two systems has (and many of these resistance proofs are based on slightly 
modified constructions from the resistance proofs for either plurality or approval due to Hemaspaandra et al. |HHR07|). 
In contrast, here we study the original variant of fallback voting, as proposed by Brams and Sanver |BS09|, in which 
votes, once cast, do not change. 
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2 Preliminaries 



2.1 Elections and Electoral Control 

An election is a pair (C,V), where C is a finite set of candidates and V is a collection of votes 
over C. How the votes are represented depends on the election system used. Many systems (such 
as majority, Condorcet, and Copeland voting as well as the class of scoring protocols including 
plurality, veto, and Borda voting; see, e.g., IIBF021 ) represent the voters' preferences as strict, linear 
orders over the candidates. In approval voting [BF78 , BF83 , Bra80], however, a vote over C is a so- 
called approval strategy, a subset of C containing all candidates approved of by this voter, whereas 
he or she disapproves of all other candidates. As is standard, we assume that collections V of votes 
over C are given as lists of ballots, i.e., if, say, five voters express the same preference (be it as a 
linear order or as an approval strategy or both) then this vote occurs five times in V. 

An election system is a rule determining the winner(s) of a given election (C,V). For example, 
in plurality-rule elections, the winners are precisely those candidates in C who are ranked first place 
by the most voters. In (simple) majority-rule elections, the winner is that candidate in C (assuming 
one exists) who is ranked first place by a strict majority of the votes (i.e., by more than 11^11/2 voters). 
In approval voting, every candidate scores one point for each approval by a voter, and whoever has 
the most points wins. 

All our control problems come in two variants: The constructive case [BTT92] focuses on the 
chair seeking to make a favorite candidate win; the destructive case [HHR07 ] is concerned with 
the chair seeking to make a despised candidate not win. Due to space, we describe these control 
problems only very briefly. Detailed, formal problem descriptions, along with many motivating 
examples and scenarios where these types of control naturally occur in real-world elections, can be 
found, e.g., in HBTT92I IHHROTI IFHHR09al IHHR09I IENR09I lBEH+091 . As an example, we state 
one such problem formally: 

Name: Constructive Control by Adding a Limited Number of Candidates. 

Given: An election (CUD,V), CflD = 0, a distinguished candidate c £ C, and a nonnegative 
integer k. (C is the set of originally qualified candidates and D is the set of spoiler candidates 
that may be added.) 

Question: Does there exist a subset D'CD such that \\D'\\ <k and c is the unique winner (under 
the election system at hand) of election (CUD',V)? 

Constructive Control by Adding an Unlimited Number of Candidates is the same except there is 
no limit k on the number of spoiler candidates that may be added. The destructive variants of both 
problems are obtained by asking whether c is not a unique winner of (CUD',V). The constructive 
control by deleting candidates problem is defined analogously except that we are given an election 
(C,V), a candidate c G C, and a deletion limit k, and ask whether c can be made a unique winner by 
deleting up to k candidates from C. The destructive version of this problem is the same except that 
we now want to preclude c from being a unique winner (and we are not allowed to delete c). 

Constructive Control by Partition (or Run-Off Partition) of Candidates takes as input an elec- 
tion (C,V) and a candidate c € C and asks whether c can be made a unique winner in a certain 
two-stage election consisting of one (or two) first-round subelection(s) and a final round. In both 
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variants, following [HHR07], we consider two tie-handling rules, TP ("ties promote") and TE ("ties 
eliminate"), that enter into force when more candidates than one are tied for winner in any of the 
first-round subelections. In the variant with run-off and under the TP rule, the question is whether C 
can be partitioned into C\ and C2 such that c is the unique winner of election (Wi UW2,V), where Wj, 
i € {1,2}, is the set of winners of subelection (C,-,V). In the variant without run-off (again under 
TP), the question is whether C can be partitioned into C\ and C2 such that c is the unique winner 
of election (Wi UC2, V). In both cases, when the TE rule is used, none of multiple, tied first-round 
subelection winners is promoted to the final round (e.g., if we have a run-off and || W2 \\ > 2 then the 
final-round election collapses to (W\,V); only a unique first-round subelection winner is promoted 
to the final round). It is obvious how to obtain the destructive variants of these eight problems for- 
malizing control by candidate partition. Summing up, we now have defined 14 candidate control 
problems. 

Constructive Control by Adding Voters is the problem of deciding, given an election (C, V U V), 
V n V' = 0, where V is a collection of registered voters and V' a pool of as yet unregistered voters 
that can be added, a candidate c £ C, and an addition limit k, whether there is a subset V" C V' 
of size at most k such that c is the unique winner of election (C, V U V"). Constructive Control by 
Deleting Voters asks, given an election (C,V), a candidate c € C, and a deletion limit k, whether 
it is possible to make c the unique winner by deleting up to k votes from V. For the TP rule, in 
Constructive Control by Partition of Voters the question is, given an election (C, V) and a candidate 
c G C, whether V can be partitioned into V\ and V2 such that c is the unique winner of election 
{W\ U W2, V), where Wj, i G {1,2}, is the set of winners of subelection (C,Vj). It is obvious how this 
problem definition changes when the TE rule is used, and also how the destructive variants of these 
four voter control problems are obtained. Summing up, we now have defined eight voter control 
problems and thus a total of 22 control problems. These problems are due to [BTT92] and [HHR07] 
(see also [FHHR09a]), and their complexity has been studied for a variety of election systems, with 
the goal of using complexity as a barrier that makes attempts of changing the outcome of an election 
via control, although not impossible, at least computationally prohibitive. 

We assume the reader is familiar with the standard complexity classes P (deterministic poly- 
nomial time) and NP (nondeterministic polynomial time) and with the notions of hardness and 
completeness. In particular, a problem B is said to be NP-hard if for each A € NP it holds that A 
(polynomial-time many-one) reduces to B, where we say A reduces to B if there is a polynomial- 
time function q> such that for each input x, x is in A if and only if <p(x) is in B. Every NP-hard 
problem in NP is said to be NP-complete. For more background on complexity theory, we refer to 
the textbooks llGJ79l |Pap94] IRot05i 

Given a control type <I>, some election systems have the advantageous property that it is never 
possible for the chair to reach his or her goal of exerting control of type <1>. In such a case, the 
system is said to be immune to <1>; otherwise, the system is said to be susceptible to <!>. We say an 
election system £ is resistant to <I> if <§ is susceptible to <I> and the control problem corresponding 
to <I> is NP-hard. If, however, S" is susceptible to <I> and the control problem corresponding to <I> is 
in P, we say £ is vulnerable to <1>. 
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2.2 Fallback Voting 



Brams and Sanver proposed two hybrid systems that combine approval voting and systems based 
on linear preferences, sincere-strategy preference-based approval voting [BS06] and fallback voting 
(FV) [BS09]. Erdelyi et al. [ENR09] studied the control complexity of SP-AV, as they dubbed their 
variant of the election system originally proposed by [BS06]. As explained in the last paragraph 
of the introduction, SP-AV combines, in a certain sense, approval with plurality voting. In this 
paper, we investigate the election system FV with respect to electoral control. FV can be thought 
of as combining, in a certain sense, approval with majority voting. Unlike in SP-AV, in FV only the 
approved candidates are ranked by a tie-free linear order. 

Definition 2.1 ([BS09]). Let (C,V) be an election. Every voter v E V provides a subset S v C C 
indicating that v approves of all candidates in S v and disapproves of all candidates in C — S v . S v is 
called v's approval strategy. In addition, each voter v € V provides a tie-free linear ordering of all 
candidates in S v . 

If S v = {ci,C2, ■ ■ ■ ,Ck} and v ranks the candidates in S v by c\ > ca > • ■ • > Ck, where c\ is v's 
most preferred candidate, C2 is v 's second most preferred candidate, etc. , and c& is v 's least preferred 
candidate ( among the candidates v approves of), we denote the vote v by 

c\ c 2 ■■■ Ck | C-S v , 

where the approved candidates to the left of the approval line are ranked and the disapproved 
candidates in C — S v are written as an (unordered) set to the right of the approval line. For each 
c € C, let 

score( Cy) (c) = \\{v G V | c G S v }\\ 

denote the number ofc's approvals in (C, V), and let score l ^ c ^ (c) be the level i score of c in (C, V), 

which is the number of c's approvals when ranked between the (inclusively) first and i th position. 
Winner determination in FV is based on determining level i FV winners as follows: 

1. On the first level, only the highest ranked approved candidates are considered in each voters' 
approval strategy. If a candidate c € C has a strict majority on this level (i.e., score, cv Ac) > 
\\v II/2 ), then c is the (unique) level 1 FV winner of the election. 

2. On the second level, if there is no level 1 winner, the two highest ranked approved candidates 
(if they exist) are considered in each voters' approval strategy. If there is exactly one can- 
didate c € C who has a strict majority on this level (i.e., score^ cv ^(c) > \\ v \\/2), then c is the 
(unique) level 2 FV winner of the election. If there are at least two such candidates, then 
every candidate with the highest level 2 score is a level 2 FV winner of the election. 

3. If there is no level 1 or level 2 FV winner, we in this way continue level by level until there is 
at least one candidate who was approved by a strict majority on the current level, say level i. 
If there is only one such candidate, he or she is the (unique) level i FV winner of the election. 
If there are at least two such candidates, then every candidate with the highest level i score is 
a level i FV winner of the election. 
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Table 1: Overview of results. Key: I means immune, S means susceptible, R means resistant, V 
means vulnerable, TE means ties eliminate, and TP means ties promote. Results new to this paper 
are in boldface. Results for approval voting are due to [HHR07] and results for SP-AV are due to 
HENR09I . 



4. For each c EC, if c is a level i FV winner of (C ,V) for some (smallest) i < \\C\\ then c is said 
to be an FV winner of (C,V). Otherwise {i.e., if for no i < \\C\\ there is a level i FV winner), 
every candidate with the highest score^c,v)( c ) i s an FV winner of (C,V). 

Note that if there exists a level 1 FV winner, he or she is always the election's unique FV winner. 
In contrast to SP-AV (where admissibility of the votes — ^ S v ^ C for each v G V — is coerced by 
moving the approval line whenever necessary, see [ENR09]), in fallback voting no changes are made 
to the ballots, regardless of the control action taken. That is, we don't require votes to be admissible, 
i.e., both empty (S v = 0) and full (S v = C) approval strategies are allowed. By definition, votes in 
an FV election are always sincere (i.e., if a voter v approves of a candidate c then the voter also 
approves of all candidates ranked higher than c). In contrast, sincerity has to be enforced in SP-AV 
by declaring insincere votes void. 

3 Results 

3.1 Overview 

Theorem l3.1l and Table Q] show the results on the control complexity of fallback voting. 

Theorem 3.1. Fallback voting is resistant, vulnerable, and susceptible to the 22 types of control 
defined in Section\2\as shown in Table\J\ 

3.2 Susceptibility 

Among the 22 control types we consider, approval voting has nine immunities [HHR07 ], see Ta- 
blet!] Some of these immunities immediately follow from the unique version of the Weak Axiom 
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of Revealed Preference (Unique-WARP, for short), which says that if a candidate c is the unique 
winner of an election (C,V) then c is also the unique winner of each election (C',V) such that 
C'cC and c € C' (where, for convenience, we use the same symbol V but view the preferences 
in V as being restricted to the candidates in C"; this convention is also adopted when we speak of 
subelections in the context of candidate-control problems). 

Unlike approval voting but just as SP-AV, fallback voting does not satisfy Unique-WARP 

Proposition 3.2. Fallback voting does not satisfy Unique-WARP. 

Proof. Consider the election (C, V) with candidate set C = {a,b,c,d} and voter collection V = 

{vi,V2,...,v 6 }: 

(CV) 

vi=V2 = vt,: a c \ {b,d} 
V4 = V5 : b d c I {a} 
V6 : d a c \ {b} 

There is no level 1 FV winner, and the unique level 2 FV winner of the election (C, V) is can- 
didate a with score^ c v ^ (a) = 4. By removing candidate b from the election, we get the subelection 
(C',V) with C = {a,c,d}. (Recall that, after removing b, V is viewed as restricted to C'; e.g., voter 
v 4 in V is now changed to d c \ {a} .) There is again no level 1 FV winner in (C',V). However, 
there are two candidates on the second level with a strict majority, namely candidates a and c. Since 
score 2 ^, v \{c) = 5 is greater than score 2 c , v Ja) = 4, the unique level 2 FV winner of the subelection 
(C',V) is candidate c. Thus, FV does not satisfy Unique-WARP. □ 

Indeed, as we will now show, fallback voting is susceptible to each of our 22 control types. Our 
proofs make use of the results of [HHR07] that provide general proofs of and links between certain 
susceptibility cases. For the sake of self-containment, we state their results, as Theorems IA.1I IA.2I 
and lA.3[ in the appendix. 

We start with susceptibility to candidate control. 

Lemma 3.3. Fallback voting is susceptible to constructive and destructive control by adding can- 
didates (in both the "limited" and the "unlimited" case), by deleting candidates, and by partition 
of candidates (with or without run-off and for each in both model TE and model TP). 

Proof. From Theorem IA.1I and the fact that FV is a voiced voting systemU it follows that FV 
is susceptible to constructive control by deleting candidates, and to destructive control by adding 
candidates (in both the "limited" and the "unlimited" case). 

Now, consider the election (C,V) given in the proof of Proposition 13.21 The unique FV winner 
of the election is candidate a. Partition C into C\ = {a,c,d} and C2 = {b}. The unique FV winner 
of subelection (C\,V) is candidate c, as shown in the proof of Proposition 13 .21 In both partition and 
run-off partition of candidates and for each in both tie-handling models, TE and TP, candidate b runs 
against candidate c in the final stage of the election. The unique FV winner is in each case candidate 

2 An election system is said to be voiced if the single candidate in any one-candidate election always wins. 
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c. Thus, FV is susceptible to destructive control by partition of candidates (with or without run-off 
and for each in both model TE and model TP). 

By Theorem IA.3I FV is also susceptible to destructive control by deleting candidates. By The- 
orem I A. 21 FV is also susceptible to constructive control by adding candidates (in both the "limited" 
and the "unlimited" case). 

Now, changing the roles of a and c makes c our distinguished candidate. In election (C,V), c 
loses against candidate a. By partitioning the candidates as described above, c becomes the unique 
FV winner of the election. Thus, FV is susceptible to constructive control by partition of candidates 
(with or without run-off and for each in both tie-handling models, TE and TP). □ 

We now turn to susceptibility to voter control. 

Lemma 3.4. Fallback voting is susceptible to constructive and destructive control by adding voters, 
by deleting voters, and by partition of voters (in both model TE and model TP). 

Proof. Consider the election (C,V), where C = {a,b,c,d} is the set of candidates and V = 
{vi,V2,V3,V4} is the collection of voters with the following preferences: 







(C,V) 


vi : 


a c 


{b,d} 


v 2 : 


d c 


1 {a,b} 


V3 : 


b a 


c | {d} 


V4 : 


b a 


1 {c,d} 



We partition V into V\ = {v\ , v 2 } and V 2 = {V3, V4}. Thus we split (C, V) into two subelections: 

(C,Vi) and (C,V 2 ) 

vi : a c \ {b,d} 
v 2 : d c \ {a,b} 

V3 : b a c I {d} 

V4 : b a I {c,d} 

Clearly, candidate a is the unique level 2 FV winner of (C,V). However, c is the unique level 2 
FV winner of (C,V\) and b is the unique level 1 FV winner of (C, V 2 ), and so a is not promoted to the 
final stage. Thus, FV is susceptible to destructive control by partition of voters in both tie-handling 
models, TE and TP. 

By Theorem lA.il and the fact that FV is a voiced voting system, FV is susceptible to destructive 
control by deleting voters. By Theorem lA.2l FV is also susceptible to constructive control by adding 
voters. 

By changing the roles of a and c again, we can see that FV is susceptible to constructive control 
by partition of voters in both model TE and model TP. By Theorem IA.3I FV is also susceptible 
to constructive control by deleting voters. Finally, again by Theorem IA.2I FV is susceptible to 
destructive control by adding voters. □ 
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3.3 Candidate Control 



All resistance results in this section follow via Lemma 13.31 showing susceptibility, and a reduc- 
tion from the well-known NP-complete problem Hitting Set [GJ79], showing NP-hardness of the 
corresponding control problem. Hitting Set is defined as follows: 

Name: Hitting Set. 

Instance: A set B = {^1,^2, • • • ,b m }, a collection = {Si,S2,. • • ,S n } of nonempty subsets S,- C B, 

and a positive integer k < m. 
Question: Does have a hitting set of size at most k, i.e., is there a set B' QB with \\B'\\ < k such 

that for each i, 5,-nfi' 7^ 0? 

We now show that fallback voting is resistant to all types of constructive and destructive candi- 
date control defined in Section 12 To this end, we present a general construction that will be applied 
(in Theorems 13.71 13.81 and 13.91 below) to all these control scenarios except constructive control by 
deleting candidates (which will be handled via a different construction in Theorem |3.10l ). 

Construction 3.5. Let (B,^ ,k) be a given instance of Hitting Set, where B = {b\,b2, ■ ■ ■ ,b m } is 
a set, J? = {Si, £2, ■■■ ,S n } is a collection of nonempty subsets S, C B, and k is a positive integer. 
Without loss of generality, we may assume that n > 1 ( since Hitting Set is trivially solvable for 
n < 1 ) and that k < m ( since B is always a hitting set of size k if m = k when 5^ contains only 
nonempty sets). 

Define the election (C,V), where C = BU {c,d,w} is the candidate set and where V consists of 
the following 6n{k+ 1) +4m+ 11 voters: 

1. There are 1m + 1 voters of the form: 

c I BU{d,w}. 

2. There are 2n + 2k(n—\) + 3 voters of the form: 

c w I BU{d}. 

3. There are 2n(k + 1) + 5 voters of the form: 

w c I BU{d}. 

4. For each i, 1 <i <n, there are 2(k+ 1) voters of the form^ 

d Si c I (B-S,)U{w}. 

3 As a notation, when a vote contains a set of approved candidates, such as c D a \ C— (DL) {a.c}) for a subset 
D C C of the candidates, this is a shorthand for c d\ ■■■ dg a \ C— (DU {a, c}) , where the elements of D= {d\ ,dg} 
are ranked with respect to a (tacitly assumed) fixed ordering of all candidates in C. 
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5. For each j, 1 < j <m, there are two voters of the form: 

d bj w | (B-{bj})U{c}. 

6. There are 2(k+ I) voters of the form: 

d w c | B. 

It is easy to see that there is no level 1 FV winner in election ({c,d,w}, V) and that we have the 
following level 2 scores in this election: 

score \{c,d,w},V)( c ) = 2(m-k) + 6n(k+\)+9, 
score 2 ^ cdw ^ v ^(d) = 2n{k+ 1) + 2(m + k + 1), and 

score l{c,d,w},v)( w ) = 4n(A; + l) + 2m + 10. 

Thus, c is the unique level 2 FV winner of ({c, d,w},V). 

The proofs of Theorems 13.71 13.81 and |3.9| below will make use of the following lemma. 

Lemma 3.6. Consider the election (C,V) constructed according to Construction \3.5\ from a 
Hitting Set instance (B,y,k). 

1. If r y has a hitting set B' of size k, then w is the unique FV winner of election (B 1 L){c,d,w},V). 

2. Let D C B U {d, w}. If c is not a unique FV winner of election (D U {c}, V), then there exists 
a set S'CB such that 

(a) D = B'u{d,w}, 

(b) w is the unique level 2 FV winner of election (B' U {c,d,w},V), and 

(c) B' is a hitting set for 5? of size at most k. 

Proof. For the first part, suppose that B' is a hitting set for y of size k. Then there is no level 1 
FV winner in election (B' U {c,d, w},V), and we have the following level 2 scores: 

score 2 (BI[j{cdw]y) {c) = 4n(k+ 1) + 2(m - k) + 9, 

scorej B , u{cdw}y) (d) = 2n(k+ 1) +2(m + k+ 1), 

score 2 B , u{cdw]y) {w) = 4n(k+ 1) +2(m-k) + 10, 

score 2 {B , u{c j w} v) (bj) < 2n(k + 1) + 2 for all bj G B'. 

It follows that w is the unique level 2 FV winner of election (B' U {c,d, w},V). 

For the second part, let D C 6U {d,w}. Suppose c is not a unique FV winner of election 
(DU{c},V). 
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(l2ab Other than c, only w is approved by a strict majority of voters and only w can tie or beat c by 
the number of approvals in (D U {c}, V). Thus, since c is not a unique FV winner of election 
(DU {c},V), w is clearly in D. In (DU {c}, V), candidate w has no level 1 strict majority, and 
candidate c has already on level 2 a strict majority. Thus, w must tie or beat c on level 2. For 
a contradiction, suppose d ^ D. Then 

score ( Du .r c j > 4n(fc+ 1) +2m+ 11. 

The overall score of w is 

score (du{c},v)( w ) = 4n(k + 1) +2m+ 10, 

which contradicts our assumption, that w ties or beats c on level 2. Thus, D = B' U {<5?,w}, 
where B' C B. 

(l2bl) This part follows immediately from part (l2al) . 

(l2cl) Let £ be the number of sets in 5? not hit by B' . We have that 

score2 (B'u{c,d,w},v)( w ) = 4n(fc+l) + 10 + 2(m-||B'||) ) 
scoref B , u{c ^ w}iV) (c) = 2(m-*) + 4n(*+l) + 9 + 2(*+l)f. 

From part (l2ab we know that 

Jco7B^ u{cAw})V) (w) > *coreJ B;u{CjdjW} v) (c), 

so 

4n(jk+l) + 10 + 2(/n- ||B'||) > 2(m- k) +4n(k+ I) +9 + 2(k+\)l. 
The above inequality implies 

1 > ^ > -jt+(jfe+l)£>0, 

so \\B'\\ -k+(k + l)£ = 0. Thus £ = 0, and it follows that B' is a hitting set for 3> of size at 
most k. 

This completes the proof of Lemma 1331 □ 

Theorem 3.7. Fallback voting is resistant to constructive and destructive control by adding candi- 
dates (both in the limited and the unlimited version of the problem). 

Proof. Susceptibility holds by Lemma 1331 NP-hardness follows immediately from Lemma 1331 
via mapping the Hitting Set instance (B,<y,k) to the instance 

1. (({c,d,w}UB,V),w,k) of Constructive Control by Adding a Limited Number of Candidates, 



11 



2. (({c,d,w} L)B,V),c,k) of Destructive Control by Adding a Limited Number of Candidates, 

3. (({c,d,w} UB,V),w) of Constructive Control by Adding an Unlimited Number of Candi- 
dates, and 

4. (({c,d,w}UB,V),c) of Destructive Control by Adding an Unlimited Number of Candidates, 
where in each case c, d, and w are the qualified candidates and B is the set of spoiler candidates. □ 

Theorem 3.8. Fallback voting is resistant to destructive control by deleting candidates. 

Proof. Susceptibility holds by Lemma 1331 To show the problem NP-hard, let (C,V) be the 
election resulting from a Hitting Set instance (B,y,k) according to Construction 13.51 and let c be 
the distinguished candidate. 

We claim that has a hitting set of size at most k if and only if c can be prevented from being 
a unique FV winner by deleting at most m — k candidates. 

From left to right: Suppose 5? has a hitting set B' of size k. Delete the m — k candidates B — B' . 
Now, both candidates c and w have a strict majority on level 2, but 

score l{c,d,w}UB',v)( c ) = 4«(£ + l)+2(m-£) + 9, 
score2 ({c,d,w}uB',v)( w ) = 4n(fc + l) + 2(m-fc) + 10, 

so w is the unique level 2 FV winner of this election. 

From right to left: Suppose that c can be prevented from being a unique FV winner by deleting 
at most m — k candidates. Let D'CSU {d,w} be the set of deleted candidates (so c D') and 
D = (C — D') — {c}. It follows immediately from Lemma [3761 that D = B' U {d, w}, where B' is a 
hitting set for 5? of size at most k. □ 

Theorem 3.9. Fallback voting is resistant to constructive and destructive control by partition of 
candidates and by run-off partition of candidates (for each in both tie-handling models, TEand TP). 

Proof. Susceptibility holds by Lemma [331 so it remains to show NP-hardness. For the construc- 
tive cases, map the given Hitting Set instance (B,y,k) to the election (C,V) from Construction 13 .5 1 
with distinguished candidate w. 

We claim that 5? has a hitting set of size at most k if and only if w can be made a unique FV 
winner by exerting control via any of our four control scenarios (partition of candidates with or 
without run-off, and for each in either tie-handling model, TE and TP). 

From left to right: Suppose has a hitting set B' C B of size k. Partition the set of candidates 
into the two subsets C\ = B' U {c, d, w} and C2 = C — C\ . According to Lemma [3761 w is the unique 
level 2 FV winner of subelection (C\,V) = (B' U {c,d,w},V). Note that w's score in the final stage 
is at least 2 (m — k) + 4n (k + 1 ) + 9. Since (no matter whether we have a run-off or not, and regardless 
of the tie-handling rule used) the opponents of w in the final stage (if there are any opponents at all) 
each are candidates from B whose score is at most 2n(k + 1) + 2, w is the only candidate in the final 
stage with a strict majority of approvals. Thus, w is the unique FV winner of the resulting election. 
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From right to left: Suppose w can be made a unique FV winner via any of our four control 
scenarios. Since c is not an FV winner of the election, there is a subset D C B U {d, w} of candidates 
such that c is not a unique FV winner of the election (DU {c},V). By Lemma 1331 there exists a 
hitting set for 5? of size at most k. 

For the four destructive cases, we simply change the roles of c and w in the above argument. □ 

Construction 13 .5 1 does not work for constructive control by deleting candidates in fallback vot- 
ing. By deleting c the chair could make w a unique FV winner, regardless of whether or not y has 
a hitting set of size k. The following theorem provides a different construction that shows resistance 
in this case as well. 

Theorem 3.10. Fallback voting is resistant to constructive control by deleting candidates. 

Proof. Susceptibility holds by Lemma 1331 To show NP-hardness, let (B,y,k) be a Hitting Set 
instance with B = {b\,b2, ■ ■ ■ ,b m } a set, = {Si, . . . ,S„} a collection of nonempty subsets 
5/ C B, and k < m a positive integer. Define the election (C,V) with candidate set 

C = BUC'UDUEU{w}, 

where C' = {ci,C2, ■ ■ ■ ,Ck+i}, D = {d\,d2, ■ ■ ■ ,d s }, E = {e\ ,e2, ■ ■ ■ ,e n }, w is the distinguished 
candidate, and the number of candidates in D is s = Y!i=i s i with s i = n + k— \\Si\\, so s = 
n 2 + kn — Yli=\ Define V to be the following collection of2(n+&+l) + l voters: 

1. For each i, 1 < i < n, there is one voter of the form: 

St Di w \ (B-Si)U(D-Di)UC'UE, 
where D i = {d l+I i- JiSj ,...,d I i j=iS .}. 

2. For each j, 1 < j < k+ 1, there is one voter of the form: 

E (C'-{cj}) cj | BUDU{w}. 

3. There are k + 1 voters of the form: 

w | BUC'UDUE. 

4. There are n voters of the form: 

C | BUDUEU{w}. 

5. There is one voter of the form: 

C w I BUDUE. 
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Note that there is no unique FV winner in the above election; the candidates in C and w are all 
level n + k + 1 FV winners. 

We claim that .y has a hitting set of size k if and only if w can be made a unique FV winner by 
deleting at most k candidates. 

From left to right: Suppose 5? has a hitting set B' of size k. Delete the corresponding candidates. 
Now, w is the unique level (n + k) FV winner of the resulting election. 

From right to left: Suppose w can be made a unique FV winner by deleting at most k candidates. 
Since k + 1 candidates other than w have a strict majority on level n + k + 1 in election (C, V), after 
deleting at most k candidates, there is still at least one candidate other than w with a strict majority 
of approvals on level n + k + 1 . However, since w was made a unique FV winner by deleting at 
most k candidates, w must be the unique FV winner on a level lower than or equal to n + k. This is 
possible only if in all n votes of the first voter group w moves forward by at least one position. This, 
however, is possible only if y has a hitting set B' of size k. □ 



3.4 Voter Control 

All vulnerability results in this section follow via Lemma 13.41 showing susceptibility, and a 
polynomial-time algorithm for the corresponding control problem. All resistance results in this 
section follow via Lemma l3T4l showing susceptibility, and a reduction from either Hitting Set or the 
well-known NP-complete problem Exact Cover by Three-Sets MGJ791 , which is defined as follows: 

Name: Exact Cover by Three-Sets (X3C). 

Instance: A set B = {bi,b2,---,b^ m }, m > 1, and a collection 5? = {5i ,52, . . . ,5 n } of subsets 

Si C B with ||5,-|| = 3 for each i, 1 <i <n. 
Question: Is there a subcollection S"' C such that each element of B occurs in exactly one set 

in y"l 

Our first result for voter control says that fallback voting is resistant to constructive control by 
adding voters and to constructive control by deleting voters. 

Theorem 3.11. Fallback voting is resistant to constructive control by adding voters and by deleting 
voters. 

Proof. Susceptibility holds by Lemma [341 in both cases. We first prove NP-hardness — and thus 
resistance — of Constructive Control by Adding Voters. Let (B,y) be an X3C instance, where 
B = {b\ , b2, ■ ■ ■ , b^m} is a set with m > 1 and y = {Si , 52, . . . , S n } is a collection of subsets 5,- C B 
with 1 1 5; 1 1 = 3 for each i, 1 <i <n. (Note that X3C is trivial to solve for m= 1.) 

Define the election (C, V U V), where C = B U {w} U D with D = {d\ d n n m _ A \ } is the set 
of candidates, w is the distinguished candidate, and V U V' is the following collection of n + m — 2 
voters 

4 This construction — just as that for SP-AV |ENR09| — is based on the corresponding construction for approval voting 
IHHRQ7). 
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1. V is the collection of m — 2 registered voters of the form: 

B | DU{w}. 

2. V' is the collection of unregistered voters, where for each i, 1 < i < n, there is one voter of 
the form: 

Di Si w | (B-Si)U(D-Di), 
where D, = {d(;_i)(3„,_4)+i,- • • >4(3m-4)}- 

Since w has no approvals in (C,V), w is not a unique FV winner in (C,V). 

We claim that 5? has an exact cover for B if and only if w can be made a unique FV winner by 
adding at most m voters from V'. 

From left to right: Suppose 5? contains an exact cover for B. Let V" contain the corresponding 
voters from V' (i.e., voters of the form D ; 5 ; - w \ (B — Si) U (D — D,) for each Si in the exact cover) 
and add V" to the election. It follows that score (c,vuv"){dj) = 1 f° r all dj G D, score (^yuv") (°./) = 
m — 1 for all o^ G B, and score (c,vuv") ( w ) = m - Thus, only w has a strict majority of approvals and 
so is the unique FV winner of the election. 

From right to left: Let V" C V' be such that ||V"|| < m and w is the unique winner of election 
(C, V U V"). Since w must in particular beat every bj G B, it follows that ||V"|| =m and each bj G B 
can gain only one additional point. Thus, the m voters in V" correspond to an exact cover for B. 

Next, we show that FV is resistant to constructive control by deleting voters. Let (B,y) be an 
X3C instance as above. Define the election (C, V), where C = B U {c, w} UD is the set of candidates 
with D = {d\ ,<5?2, • • • ,d3nm}, w is the distinguished candidate, and V is the following collection of 
2n + m — 1 voters: 

1. For each i, 1 <i <n, there is one voter of the form: 

St c | (B-Si)UDU{w}. 

2. For each i, 1 <i <n, there is one voter of the form: 

Bi Di w | (B-B ; )U{c}U(D-A), 
where, letting £ y = ||{5,- G | G 5,-}|| for each j, \ <j< 3m, B { = {bj eB\i<n- ij) and 

Di = {^((-l)3m+l)---)^3(m-||Bi||}- 

Note that D ; = if = 3m. Note also that w is always ranked on the (3m + l) rt place. 

3. There are m — 1 voters of the form: 

c | BUDU{w}. 

Note that scoreiw) = scoreibi) = n for all i, I <i < 3m, score(dj) = 1 or score(dj) = for all 
dj G D, and score (c) = n + m — 1 , and since only c has a strict majority (which is reached on level 4), 
c is the unique level 4 FV winner of the election. 
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We claim that has an exact cover for B if and only if w can be made a unique FV winner by 
deleting at most m voters. 

From left to right: Suppose 5? contains an exact cover for B. By deleting the corresponding 
voters from the first voter group, we have the following scores: score(w) = n, score(b\) = score{c) = 
n — 1 for all i, 1 < i < 3m, and score (dj) = 1 or score(dj) = for all dj G D. Since there are now 
2n — 1 voters in the election, only candidate w has a strict majority, so w is the unique FV winner of 
the election. 

From right to left: Suppose w can be made a unique FV winner by deleting at most m voters. 
Since w's approvals are all on the (3m + l) st position, neither c nor any of the b\ can have a strict 
majority on any of the previous levels. In particular, candidate c must have lost exactly m points 
after deletion, and this is possible only if the m deleted voters are all from the first or third voter 
group. On the other hand, each bj G B must have lost at least one point after deletion, and this is 
possible only if exactly m voters were deleted from the first voter group. These m voters correspond 
to an exact cover for B. □ 

In contrast to the constructive voter-control cases of Theorem 13.1 II fallback voting is vulnerable 
to destructive control by adding voters and to destructive control by deleting voters. In fact, the 
proof of Theorem 13.121 shows something slightly stronger: FV is what HHHR071 call "certinably 
vulnerable" to these two destructive voter-control cases, i.e., the algorithm we present in this proof 
for destructive control by adding voters even computes a successful control action if one exists 
(instead of only solving the corresponding decision problem) 

Theorem 3.12. Fallback voting is vulnerable to destructive control by adding voters and by deleting 
voters. 

Proof. Susceptibility holds by Lemma l3T4l in both cases. We present a polynomial-time algorithm 
for solving the destructive control by adding voters case. We will make use of the following notation. 
Given an election (C,V), let maj(V) = Lll y ll/2j + 1 and define the deficit of candidate d G C for 
reaching a strict majority in (C,V) on level i, 1 < i < \\C\\, by 

de f\c.y)( d ) = maj(V) - score\ cv) (d). 

The input to our algorithm is an election (C,V UV') (where C is the set of candidates, V is 
the collection of registered voters, and V' is the collection of unregistered voters), a distinguished 
candidate c G C, and an integer £ (the number of voters allowed to be added). The algorithm either 
outputs a subset V" C V', \\V"\\ < £, that describes a successful control action (if any exists), or 
indicates that control is impossible for this input. 

We give a high-level description of the algorithm. We assume that c is initially the unique FV 
winner of election (C,V); otherwise, the algorithm simply outputs V" = and halts, since there is 
no need to add any voters from V'. 

Let n = maxvevuv/ ||5 V ||. Clearly, n < \\C\\. The algorithm proceeds in at most n + 1 stages, 
where the last stage is the approval stage and checks whether c can be dethroned as a unique FV 

5 And the same holds for the algorithm showing that FV is vulnerable to destructive control by deleting voters, which 
is not presented here due to space. 
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winner by approval score via adding at most I voters from V', and all preceding stages are majority 
stages that check whether a candidate d ^ c can tie or beat c on level i via adding at most I voters 
from V'. Since the first majority stage is slightly different from the subsequent majority stages, we 
describe both cases separately. 

Majority Stage 1: For each candidate d € C — {c}, check whether d can tie or beat c on the first 
level via adding at most I voters from V'. To this end, first check whether 

(3.1) def\ cv) {d) < -; 

(3.2) score ( C v \{d) > score, cv \{c) — £. 

If (13.11 ) or (13.21 ) fails to hold, this d is hopeless, so go to the next candidate (or to the next stage 
if all other candidates have already been checked in this stage). If (13.11 ) and (13.21) hold, find a set 
Vj C V' of largest cardinality such that ||Vj|| < I and all voters in V d approve of d on the first level 
but disapprove of c on the first level. Check whether 

(3.3) score^y^id) > score\ cyuvi) {c). 

If (13.31) fails to hold, this d is hopeless, so go to the next candidate (or to the next stage if all other 
candidates have already been checked in this stage). If (13.31) holds, check whether d has a strict 
majority in (C,V U Vj) on the first level, and if so, output V" = V' d and halt. 

Majority Stage i, 1 < i < n: This stage is entered only if it was not possible to find a successful 
control action in majority stages 1, 1. For each candidate d € C — {c}, check whether d can 
tie or beat c up to the ith level via adding at most I voters from V'. To this end, first check whether 

(3.4) def\ cv) {d) < ~; 

(3.5) score'^ cv ^(d) > score'r cv \(c) — £. 

If (13.41 ) or (13.51 ) fails to hold, this d is hopeless, so go to the next candidate (or to the next stage 
if all other candidates have already been checked in this stage). If ( 13.41 ) and ( 13.51 ) hold, find a set 
V'j C V' of largest cardinality such that || Vj || < I and all voters in Vj approve of d up to the ith level 
but disapprove of c up to the ith level. Check whether 

(3.6) score'^ y^ (d) > score^ CVuV ^ (c) 

If (13.61) fails to hold, this d is hopeless, so go to the next candidate (or to the next stage if all other 
candidates have already been checked in this stage). If ( 13.61) holds, check whether d has a strict 
majority in (C,V U V' d ) on the z'fh level, and if so, check whether 

(3.7) score [cyuv>) ( c ) ^ ma J( V uV d)- 

If (f3?7T > fails to hold, output V" = V' d and halt. Otherwise (i.e., if (f3?7T > holds), though d might be 
able to dethrone c by adding Vj on the /th level, this was not early enough, since c has already won 
at a previous level. In that case, find a largest set W' cd C V' such that 
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1. ||vjuv^||<*, 

2. all voters in V' cd approve of both c and d up to the zth level, and 

3. the voters in V' cd are chosen such that c is approved of as late as possible by them (i.e., at 
levels with a largest possible number, where ties may be broken arbitrarily). 

Now, check whether 

(3.8) score'^y^,^ (c) > maj(V UV d U V'. d ). 

If (13.81 ) holds, then this d is hopeless, so go to the next candidate (or to the next stage if all other 
candidates have already been checked in this stage). Otherwise (i.e., if (13.81 ) fails to hold), check 
whether ||V^|| > def l i CVUV ,^{d). If so (i.e., d has now a strict majority on level i), output V" = 
V d U V' cd and halt. Note that, by choice of V' cd , (f376l > implies that 

score l {py uv p v ^ (d) > score'^ cvuv , uv ,j(c). 

Thus, in (C,V L>V d U V c ' rf ), d ties or beats c and has a strict majority on the ith level (and now, we are 
sure that d was not too late). Otherwise (i.e., if ||V^|| < def\ cvuv ,dd)), this d is hopeless, so go to 
the next candidate (or stage). 



Approval Stage: This stage is entered only if it was not possible to find a successful control action 
in majority stages l,...,n. First, check if 



(3.9) score (c y) (c) < 



+ 1. 



If (13.91) fails to hold, output "control impossible" and halt, since we have found no candidate in 
the majority stages who could tie or beat c and have a strict majority when adding at most £ voters 
from V', so adding any choice of at most I voters from V' would c still leave a strict majority. 
If (13.91 ) holds, looping over all candidates d G C — {c}, check whether there are score^ c .v){ c ) ~ 
score (cy\ (d) < £ voters in V' who approve of d and disapprove of c. If this is not the case, move on 
to the next candidate, since d could never catch up on c via adding at most £ voters from V . If it is 
the case for some d € C — {c}, however, add this set of voters (call it V d ) and check whether 

(3.10) score(c iVL >v^(c) <maj(VUV d ). 

If (13.101 ) holds, output V" = Vj and halt. Otherwise (i.e., if (13.101 ) fails to hold), check whether 
(3-11) *-||Vj|| > ||V '|| 

/ \ \\vuv',\ 

> 2 I score (cyyjv,) (c) 

where V$ is contained in the set of voters in V' who disapprove of both candidates c and d. If (13.111) 
does not hold, move on to the next candidate, since after adding these voters c would still have a 
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strict majority. Otherwise (i.e., if (13.111 ) holds), add exactly 2 ( score ^c,vuv^)( c ) — V^v'iW/ij voters 
from V ' (denoted by V£ + ). Output V" = V' d U V£ + and halt. 

If we have entered the approval stage (because we were not successful in any of the majority 
stages), but couldn't find any candidate here who was able to dethrone c by adding at most I voters 
from V', we output "control impossible" and halt. 

The correctness of the algorithm follows from the remarks made above. Crucially, note that the 
algorithm proceeds in the "safest way possible": If there is any successful control action at all then 
our algorithm finds some successful control action. It is also easy to see that this algorithm runs in 
polynomial time. (Note that we didn't optimize it in terms of running time; rather, we described it 
in a way to make it easier to check its correctness.) 

The deleting-voters case follows by a similar algorithm (and is omitted here due to space). □ 

Theorem 3.13. Fallback voting is resistant to constructive control by partition of voters in 
model TE. 

Proof. Susceptibility holds by Lemma I3T41 To prove NP-hardness, we reduce X3C to our control 
problem. Let {B,y) be an X3C instance with B = {b\,b2, ■ ■ • ,bj m }, m> I, and a collection 5? = 
{Si, 52) • • • ,S n } of subsets S; C B with ||5,-|| = 3 for each i, 1 < i < n. Our construction, like the 
corresponding one for SP-AV [ENR09], is based on the corresponding construction for approval 
voting [HHR07]. Define the election (C, V), where C = BU {c,x,y,w} UZ is the set of candidates, 
Z = {z\,Z2, ■ ■ ■ ,z n }, and w is the distinguished candidate. Define the value £j = ||{S, £ \ bj € 5/}|| 
for each j, 1 < j < 3m. Let V consist of the following An + 2m — 1 voters: 

1. For each i, 1 < i < n, there is one voter of the form: 



c Si | (B 



Si)U{x,y,w}UZ. 



2 



For each i, !</<«, there is one voter of the form: 



{Z-{ Zi }) Bi w | (B-Bi) 



{c,x,y,Zi} 



where B ; = {bj € B | i < n - £j}. 
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For each i, 1 <i<n, there is one voter of the form: 



c zt | BU{x,y,w}U{Z 



{«})• 



4 



There are n+m voters of the form: 



.x- | BU{c,y,w}UZ. 



5 



There are m — 1 voters of the form: 



y | BU{c,x,w}UZ. 
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Note that for each i G {l,...,n} and for each j G {I, ... ,3m}, we have score^ CV )(bj) = 

score \cy)(zi) = scorerc,v)( w ) = w > score (C,v)( c ) = 2n> score (c,v) ( x ) =n + m, and score ( C) y) (y) = 
m— 1. Thus, there is no candidate with a strict majority on any level in election (C,V) and, in 
particular, candidate w is not a unique FV winner. 

We claim that 3 has an exact cover for B if and only if w can be made a unique FV winner of 
the resulting election by partition of voters in model TE. 

From left to right: Suppose 3* contains an exact cover 3" for B. Partition V in the following 
way. Let Vi consist of: 

• the m voters of the first group that correspond to the exact cover (i.e., those m voters of the 
form c Si | (B - Si) U {x,y, w} U Z for which 5,- G ,9"), 

• the n voters of the third group (who approve of c and zd, and 

• the n + m voters of the fourth group (who approve of only x). 

Let V% = V — Vi. In subelection (C,Vi), no candidate has a strict majority on any level, and c and 
.x" tie for first place on the first level, both with score n + m = \\ v A\/i. Thus, there is no candidate 
proceeding forward to the final round. In subelection (C, V2), only candidate w has a strict majority, 
so w is the only participant in the final round of the election and thus has been made a unique FV 
winner by this partition of voters. 

From right to left: Suppose that w can be made a unique FV winner by exerting control by 
partition of voters in model TE. We can argue for FV as BENR091 do for SP-AV (see also [HH R07I0 : 
Let (Vi , V<i) be such a successful partition. Since we are in model TE, w has to be the unique winner 
of one of the subelections, say of (C,Vi). Each voter of the form c Zi | BU{x,y,w}U (Z— {z,-}) 
has to be in V2, for otherwise there would be a candidate z.i G Z with score (ry{){zi) = score^ cv ^(w) = 
n, and Zi would get his or her approvals on an earlier level than w. Thus, w would not be the 
unique winner of subelection (C,Vi). On the other hand, there can be only m voters of the form 
c 5, I (B — Sj) U {x,y,w}UZ in Vi, for otherwise c would have the highest score in subelection 
(C,V2)> namely score^ c ,v 2 )( c ) > n + m, and c would reach this score already on level 1. Thus, c 
would be the unique winner of subelection (C,^), and would also beat w in the run-off because 
none of the candidates c and w would have a strict majority in election ({c,w},V), but c would beat 
w by approval score. So there are at most m voters of the form c Sj \ (B — Si) U {x,y, w} U Z in Vi. 
However, there must be exactly m such voters in Vi and these m voters correspond to an exact cover 
for B, since otherwise there would be a candidate bj G B that has the same score in subelection 
(C,Vi) as w, namely n points, and bj would get his or her approvals on an earlier level than w, 
contradicting the assumption that w is the unique FV winner of subelection (C,V\). □ 

Finally, we turn to control by partition of voters in model TP. We start with the constructive 
case. 

Theorem 3.14. Fallback voting is resistant to constructive control by partition of voters in 
model TP. 
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Proof. Susceptibility holds by Lemma [3~4l The proof of resistance is based on the construction 
of HENR09I Thm. 3.14]. Let (B,y) be an X3C instance with B = {b l ,b 2 ,...,b 3m }, m>\, and 
a collection = {Si,S2, ■ ■ ■ ,S n } of subsets S; C B with =3 for each i, 1 < i < n, and let 
n > m+ 1. Define the election (C, V ), where C = fiUFUZU {w,x,y} is the set of candidates, where 
F = {fi,fzi-- - ifn+m+i }> Z = {zi ,Z2, • • • an d w i s tne distinguished candidate. Define the value 
lj = \\{Si ey\ bj G Si} I for each 7, 1 < j < 3m. Let V consist of the following 6n + 2m + 2 voters: 

1. For each i, 1 < i < n, there is one voter of the form: 

y Sj I (B-Si)UFUZU{w,x}. 

2. For each i, 1 < i < n, there is one voter of the form: 

y Zi \ SUFU(Z-{z;})U{w,i}. 

3. For each i, 1 <i <n, there is one voter of the form: 

(Z-{ Zi }) Bi w I (B-Bi)UFU{x,y,Zi}, 
where fi ; = {bj G B \ i < n - lj}. 

4. There are n voters of the form: 

Z B w I FU{x,y}. 

5. There are n + m + 1 voters of the form: 

x I BUFUZU{w,y}. 

6. For each 1 <k <n + m+l, there is one voter of the form: 

fk I BU(F-{f k })UZU{w,x,y}. 

The overall scores of the candidates in election (C, V) can be seen in Table [2] 





w 


X 


y 


bj 


fk 


Zi 


score {cy) 


2n 


n + m+\ 


2n 


2n 


1 


2n 



Table 2: Overall scores in (C,V). 



Since the strict majority threshold for V is 3n + m + 2, there is no candidate with a strict majority 
on any level in election (C,V) and, in particular, since score^ C y^{y) = score(cy){w), candidate w is 
not a unique FV winner. 

We claim that has an exact cover for B if and only if w can be made a unique FV winner via 
exerting control by partition of voters in model TP. 

From left to right: Suppose ^ contains an exact cover 5?" for B. Partition V in the following 
way. Let V\ consist of: 
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• the m voters of the first group that correspond to the exact cover (i.e., those m voters of the 
form y Si | (B - S t ) UF UZU {w,x} for which S; G S"), 

• the n voters of the second group (who approve of y and Zi for all i, 1 < i < n), and 

• the n + m + 1 voters of the fifth group (who approve of only x). 
LetV 2 = V-V l . 





w 


X 


y 


bj 


/* 


Zi 


score {cy{] 





n + m+\ 


n + m 


1 





1 



Table 3: Scores in (C,Vi). 



Table|3]shows the overall scores of all candidates in subelection (C,V\). Since the strict majority 
threshold is n + m + 1 in subelection (C,V\), only candidate x has a strict majority. Thus x is the 
unique FV winner of subelection (C,V\) and is proceeding forward to the final round. 





w 


X 


y 




fk 


Zi 


score (C y 2) 


In 





n — m 


2n-l 


1 


2n-\ 



Table 4: Scores in (C, V2). 



Table |4] shows the overall scores of all candidates in subelection (C,V2). In this subelection, 
the strict majority threshold is 2n + 1. As one can see in Table 01 there is no candidate with a 
strict majority on any level in election (C,Vz). Among all candidates, w has the highest score in 
subelection (C, V2) and thus moves forward to the final round. 

Since in the final round none of the two candidates, x and w, has a strict majority on any level, 
and since score ({ w , x }y)(w) =2n>n + m+\ = score^ wx j y)(x) because n >m + 1, candidate w is 
the unique FV winner in the election resulting from this partition of voters. 

From right to left: Suppose that w can be made a unique FV winner by exerting control by 
partition of voters in model TP. Let V = (Vi 3 l^) be some such successful partition. In order to 
prove that has an exact cover for B, we will show the following three statements: 

1. The final round of the election corresponding to partition V = {V\ , V2) consists of the candi- 
dates x and w. 

2. .y has a cover for B. 

3. This cover is an exact cover. 

As to (1), among all candidates, only candidate x and the candidates in F have a score less than 
score (c,v)(w) ( see Table©. Thus, these are the only possible candidates who could face w in the 
final roundO Now, a candidate fk can get into the final round only if in fy's first-round subelection 

6 Note that in election (C, V), no candidate has a strict majority. This remains true, if we remove candidates from C. 
Thus, the winner of the final round is a winner by score and not by majority on any level. 
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there are only voters from the sixth group and at most one voter from the fifth group0 So, if a 
candidate could make it to the final round then w has to be the unique FV winner of the other 
first-round subelection. However, this is not possible, since both y and w get 2n points in that 
subelection, and y gains his or her points already on the first level. Thus, no candidate ft £ F can 
participate in the final round. It follows that the only way to make w a unique FV winner via exerting 
control by partition of voters in model TP is that w faces only candidate x in the final round. 

As to (2), let x be the unique FV winner of subelection (C, V\) and w the unique FV winner of 
subelection (C,V^). Since in each vote in the third and fourth voter group, each candidate bj € B 
appears on an earlier level than w, there has to be a cover in 5? for B, for otherwise there would be 
at least one bj £ B who ties w in (C,V2) by score, and reaches that score on an earlier level than w. 
Let the size of the cover be m'. Note that m' > m. 

As to (3), note that each voter of the second group has to be in (C, V\ ), for otherwise there would 
be at least one n € Z who ties w in (C, V%) by score, and reaches that score on an earlier level than w. 
The following must hold: 

score (c,Vi)( x ) ~ score (c,v 1 )(y) = (n + m+l) — (n + m) = m + 1 — m > 0. 
This is possible only if m' = m. Hence, y has an exact cover for B, which completes the proof. □ 

The following construction will be used to handle the destructive case of control by partition of 
voters in model TP. 

Construction 3.15. Let (B, y } k) be a given instance o/Hitting Set, where B = {bi,bz, ■ ■ ■ ,b m } is a 
set, y = {Si , S2 , ■ • • , S„ } is a collection of nonempty subsets Si C B, and k<mis a positive integer^ 
Define the election (C,V), where C = B U D U E U {c,w} is the candidate set with D = 
{d\ , . . . ,d 2 ( m+ i)} and E = {e\, . . . ,^2(m-i)} an d where V consists of the following 2n(k+ 1) +4m + 
2mk voters: 

1. For each i, 1 <i <n, there are k+l voters of the form: 

w Si c I DUEU(B-Si). 

2. For each j, 1 < j <m, there is one voter of the form: 

c bj w I (B-{bj})UDUE. 

3. For each j, 1 < j <m, there are (k — 1) voters of the form: 

bj I (B-{bj})UDUEU{c,w}. 

7 Otherwise, since score ^ c y){fk) = 1, it might happen that y or a candidate Zi £ Z would also be a winner in this 
subelection and would move forward to the final round. 

8 Note that the assumption k <m can be made without loss of generality, since the problem Hitting Set becomes trivial 
if k = m. 
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c 


w 


bj 


d p 


e r 


score 1 


n(k+ 1) + 2m + mk 


B(Jt+l) + l 


k-l 


< 1 


1 


score 2 


n(k+l)+2m+mk+1 


n(k+l)+mk + k 


<k + n(k+\) 


1 


1 


score 3 


>n(k+l)+2m + mk+l 


n(k + 1 ) + mk + k + 2m + 1 


< k + n(k+l) 


1 


1 



Table 5: Scores in (C, V). 



4. For each p, 1 < p < m + 1, there is one voter of the form: 

di( P -\)+\ d 2p w | BU(D-{d 2 ( p -i) + i,d 2 p})UEU{c}. 

5. For each r, 1 < r < 2(m — 1), there is one voter of the form: 

e r | BUDU(E-{e r }U{c,w}. 

6. There are n{k+\)+m — k+ \ voters of the form: 

c | BUDUEU{w}. 

7. There are mk + k — 1 voters of the form: 

c w | BUDUE. 

8. There is one voter of the form: 

w c | BUDUE. 

The strict majority threshold for V is maj (V) = n{k + 1) + 2m + mk + \. In election (C, V), only 
the two candidates c and w reach a strict majority, w on the third level and c on the second level (see 
Table[5]). Thus c is the unique level 2 FV winner of election (C, V). 

The proof of Theorem l3. 171 will make use of the following claim. 

Claim 3.16. In election (C,V) from Construction \3.15\ for every partition ofV into V\ and V 2 , 
candidate c is an FV winner of either (C, Vi) or (C,V 2 ). 

Proof. For a contradiction, suppose that in both subelections, (C,V\) and (C,V 2 ), candidate c is 
not an FV winner. In particular, c can have no strict majority in either of (C, Vi) and (C,V 2 ). Since 
(c) = 11^11/2, the two subelections must satisfy the following conditions: 

1. Both ||Vi || and || V2 [| are even numbers and 

2. score l ^ cv ^(c) = W\\\/ 2 and score l ^ c y ^{c) = \\ v i\\/2. 

Otherwise, c would have a strict majority already on the first level in one of the subelections. 
Since in both subelections c has only one point less than the strict majority threshold already on the 
first level, and since c will get a strict majority no later than on the second level, in both subelections 



24 



there must be candidates whose level 2 scores are higher than the level 2 score of candidate c. Table[5] 
shows the level 2 scores of all candidates. Only candidates w and a bj € B have a chance to tie or 
beat candidate c on that level. 

Essentially, there are two possibilities for winning the two subelections. First, it is possible that 
both subelections are won by two distinct candidates from B (say, b x is a winner of (C, Vi) and b y is 
a winner of (C,V2)). Thus the following must hold: 



score\ CVi) {b x )+score 2 {cyi) {b } ) > score\ cv) {c) 

2n(k+\)+2k-n(k+l) > n(k+\)+mk + 2m+\ 

2k > mk + 2m + 1 

> {m-2)k + 2m+l. 

This is a contradiction to the basic assumption that both k > and m > 0. Thus only the second 
possibility for c to lose both subelections remains, namely that one subelection, say (C,V\), is won 
by a candidate from B, say b x , and the other subelection, (C,V2), is won by candidate w. Then it 
must hold that: 

score\ CVi) {b x ) + score 2 [CV2) {w) > score\ cv) {c) 
n(k+l)+k-n{k+l)+n(k+l)+mk + k > n{k+l)+mk + 2m+\ 

2k > 2m+l. 

This is a contradiction to the assumption that k < m, so c must be an FV winner in one of the 
subelections. □ 



Theorem 3.17. Fallback voting is resistant to destructive control by partition of voters in model TP. 

Proof. Susceptibility holds by Lemma [3~4l To prove NP-hardness, we reduce Hitting Set to our 
control problem. Consider the election (C,V) constructed according to Construction 13. 151 from a 
given Hitting Set instance (B,y,k), where B = {b\ b m } is a set, y = {S\ , . . . ,£„} is a collection 
of nonempty subsets 5; C B, and k < m is a positive integer. 

We claim that has a hitting set B' C B of size k if and only if c can be prevented from winning 
by partition of voters in model TP. 

From left to right: Suppose, B' C B is a hitting set of size k for 5? . Partition V into V\ and V2 
the following way. Let V\ consist of those voters of the second group where bj € B' and of those 
voters of the third group where bj G B'. Let V2 = V — V\. In (C,V\), no candidate reaches a strict 
majority (where maj(Vi) = ||5'|| + 1=^+1), and candidates c, w, and bj € B' win the election with 
an approval score of k (see Table [6]). 

The scores in election (C, V2) are shown in Table|7J 

Since in election (C,V%) no candidate from B wins, the candidates participating in the final 
round are B' U {c, w}. The scores in the final election (B' U {c, w}, V) can be seen in Table[8] Since 
candidates c and w are both level 2 FV winners, candidate c is no longer the unique FV winner of 
the election. 
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w 


bj € B' 


bj?B> 


score 1 


k 





k-1 





score 2 


k 





k 





score J 


k 


k 


k 






Table 6: Scores in (C,V\). 
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w 






score 1 


n(k+ 1) + 2m — k + mk 


n{k+l) + l 


k-l 





score 2 


n(k+ l)+2m—k + mk + 1 


n(k+l)+mk + k 


<k + n(k+\) 


<n(Jfc+l) 


score 3 


> n(k+l)+2m-k+mk+l 


n(k+l)+mk + 2m + l 


<k + n(k+\) 


<n(Jfc+l) 



Table 7: Scores in (C, V2). 





c 


w 


bjeB' 


score 1 


n(k+ 1) + 2m + mk 


n(k+l)+m + 2 


k-l 


score 2 


n(k+l)+2m + mk+l 


n(k+l)+2m + mk+l 


<k + n(k+\) 



Table 8: Scores in (B' U {c,w},V). 



From right to left: Suppose candidate c can be prevented from winnning by partition of voters 
in model TP. From Claim I3T61 it follows that candidate c participates in the final round. For a con- 
tradiction, suppose that has not a hitting set of size k. Since c has a strict majority of approvals, 
c has to be tied with or lose against another candidate by a strict majority at some level. Only can- 
didate w has a strict majority of approvals, so w has to tie or beat c at some level in the final round. 
Because of the scores of the candidates from D and E we may assume that only candidates from B 
are participating in the final round besides c and w. Let B' C B be the set of candidates who also 
participate in the final round and let t be the number of sets in 5? not hit by B '. Note that w cannot 
reach a strict majority of approvals on the first level, so we consider the level 2 scores of c and w: 

«WK(B'u{c,w},v) ( c ) = n (k+ 1) + 1m + mk+ 1 +£(k+ 1) and 

score \b'u{c,w},V)( w ) = n(k+\)+2m + mk + k-\\B'\\ + \. 

Since c has a strict majority already on the second level, w must tie or beat c on this level, so the 
following must hold: 

^ore 2 {B , u{c w}y) (c) - score 2 (B , u{cM v) (w) < 
n{k+\) + 2m + mk+\+i(k+\)-n(k+\)-2m-mk-k+\\B'\\-\ < 

||fi'||-£ + ^+l) < 0. 

This is possible only if i = 0, which contradicts to our assumption that there are sets in 5? that 
are not hit by B' . From t = it follows that ||5'|| < k, so S" has a hitting set of size at most k. □ 
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4 Conclusions and Open Questions 



We have shown that Brams and Sanver's fallback voting system [BS09] is, like plurality voting and 
SP-AV, fully resistant to candidate control. Also, like Copeland voting MFHHR09al and SP-AV, 
fallback voting is fully resistant to constructive control. Regarding voter control, all eight cases in 
FV are susceptible, and we have shown resistance to constructive control by adding, by deleting, 
and by partition of voters in models TE and TP, and by destructive control to partition of voters 
in model TP. We have also shown vulnerability to destructive control by adding and by deleting 
voters. Only one case remains open: destructive control by partition of voters in model TE. It would 
be interesting to know whether FV is resistant or vulnerable to this control type. 

Plurality voting is one of the other two systems for which full resistance to candidate control 
is known [HHR07], but it has fewer resistances to voter control than fallback voting. SP-AV (the 
other system with known full resistance to candidate control) does have the same number of proven 
resistances |ENR09l to voter control as fallback voting. However, as has been argued in the intro- 
duction, it is less natural a system than fallback voting. Also, it is still possible that fallback voting 
might turn out to have even one more resistance to control than SP-AV in total. 

Of course, resistance to control is not the only — and probably not even the most important — 
criterion to guide one's choice of voting system. Many other properties of voting systems (especially 
their social choice weaknesses and strengths) are important as well and perhaps even more impor- 
tant. For example, representing votes in plurality is a slightly simpler task than in fallback voting 
or SP-AV: Plurality voters simply give a ranking of the candidates and the candidates with the most 
top positions win, whereas fallback and SP-AV voters provide both their approvals/disapprovals of 
the candidates and a ranking of the candidates (of all candidates in SP-AV and of only the approved 
candidates in fallback voting). Also, winner determination in fallback voting and in SP-AV is a 
slightly more complicated task than in plurality voting — though still easy. Regarding the social 
choice benefits of FV, we mention that it satisfies, e.g., monotonicity and refer to [BS09] for a more 
detailed discussion and further interesting results. 

Supposing one does care about control resistance, when choosing a voting system one's choice 
will most likely (along with the system's social choice properties, of course) depend on the types 
of control one cares most about in the intended application. Also, when comparing voting systems, 
one should weigh the nine immunities, four resistances, and nine vulnerabilities to control approval 
voting is known to possess [HHR07] against FV's at least 19 (and possibly even 20) resistances and 
at least two (and at most three) vulnerabilities to control. 
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A Some Results of [HHR07] Used in Section S3 



Theorem A.l ([HHR07]). 1. If a voiced voting system is susceptible to destructive control by 
partition of voters ( in model TE or TP), then it is susceptible to destructive control by deleting 
voters. 



2. Each voiced voting system is susceptible to constructive control by deleting candidates. 

3. Each voiced voting system is susceptible to destructive control by adding candidates^ 

Theorem A.2 ([HHR07]). 1. A voting system is susceptible to constructive control by adding 
candidates if and only if it is susceptible to destructive control by deleting candidates. 

2. A voting system is susceptible to constructive control by deleting candidates if and only if it 
is susceptible to destructive control by adding candidates. 

9 Following Bartholdi et al. |BTT92|, Hemaspaandra et al. IHHR07I considered only the case of control by adding a 
limited number of candidates — the "unlimited" case was introduced only in (the conference precursors of) |FHHR09a|. 
However, it is easy to see that all results about control by adding candidates stated in Theorems I A. 1 1 17P1 and lA.3l hold 
true in both the limited and the unlimited case. 
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3. A voting system is susceptible to constructive control by adding voters if and only if it is 
susceptible to destructive control by deleting voters. 

4. A voting system is susceptible to constructive control by deleting voters if and only if it is 
susceptible to destructive control by adding voters. 

Theorem A. 3 ([HHR07]). 1. If a voting system is susceptible to constructive control by parti- 
tion of voters (in model TE or TP), then it is susceptible to constructive control by deleting 
candidates. 

2. If a voting system is susceptible to constructive control by partition or run-off partition of 
candidates (in model TE or TP), then it is susceptible to constructive control by deleting 
candidates. 

3. If a voting system is susceptible to constructive control by partition of voters in model TE, 
then it is susceptible to constructive control by deleting voters. 

4. If a voting system is susceptible to destructive control by partition or run-off partition of 
candidates (in model TE or TP), then it is susceptible to destructive control by deleting can- 
didates. 
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